The Security Risk Assessment Handbook, 2nd Edition

145

© 2011 by Taylor & Francis Group, LLC

Chapter 6

Administrative 

Data Gathering

Each of the next three chapters is dedicated to the topic (or security risk assessment

phase) of data gathering. e topic of data gathering is a large one and encom-

passes many activities and security controls. is large topic has been divided into

three groups—administrative (Chapter 6), technical (Chapter 7), and physical

(Chapter8)—to facilitate the use of this book and to provide security risk assess-

ment team members with target guidance on their area of review.

In Chapter 5, the Review, Interview, Inspect, Observe, Test (RIIOT) data-

gathering method ...